1. Data controller
The controller is ParchesNow, based in Medellín, Colombia. We handle personal data requests at the support address at the end of this document, which is also the channel to exercise your rights.
ParchesNow currently operates as a pre-launch project. Once the company running it is incorporated, this section will carry its legal name and tax ID, and we will publish the updated version at this same address.
2. What it covers
The website, the mobile app, the store and the emails we send you. It does not cover third-party sites we link to, or what you do in a venue you discovered here.
3. What data we process
We ask for no more than the feature needs. These are the categories and where they come from:
You can buy without creating an account. In that case we keep the order with the email you type, the shipping address and the rest of the purchase details, and we email you a link to follow it. That link is the order’s only key: whoever has it can see its status, the items and the total, but not your address, phone or ID number, so don’t share it. If you later create an account with that email and verify it, the orders made with it move to your account; if you don’t, they stay available through the link.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email, hashed password, display name, username, verification status | You, when you register |
| Profile | Photo, bio, city, interests, links, gender if you state it | You, when you fill it in |
| Sign-in with Google | Verified email, name and photo from your Google account | Google, if you choose it |
| Activity | Saved and visited places, plans and clubs, posts, comments, reactions, friendships, reviews and contributions | Your use of the platform |
| Messages | What you write in a plan or club thread | You, as you write them |
| Location | The approximate location you allow so we can show what is nearby, and the coordinates of the addresses you save | Your device, with your permission |
| Purchases | Orders, items, amounts, delivery address, recipient, phone and ID number | You, when you buy |
| Payments | Transaction reference, status, method and date. Never your card number | The payment gateway |
| Play | Reputation, level, missions, badges, streaks and ranking position | Your activity on the platform |
| Technical | IP address, browser and device type, language, pages viewed and errors | Automatic, when you connect |
| Support | What you send through the contact form or by email | You, when you write |
4. What we use it for
Every field has a purpose, and is not reused for another without telling you:
- Create and maintain your account, verify your email and keep your session open.
- Show what makes sense near you and in the categories you follow.
- Run plans, clubs, messages, friendships and posts.
- Process, charge, ship and support orders, warranties and returns.
- Prevent fraud, abuse and impersonation, and enforce the community policies.
- Answer what you write to us.
- Send you news, only if you subscribe, and service notices, which are not marketing.
- Understand how the platform is used and improve it: with Google's tools, only if you accept measurement; with the store's anonymous count, without identifying you.
- Comply with legal, accounting and tax obligations.
5. On what basis
The general basis is your authorisation, given when you register and accept these documents, and revocable at any time. We also process data when it is needed to perform our contract with you —delivering an order, running your account—, to comply with a legal duty, or for a legitimate and proportionate interest such as platform security.
We do not process sensitive data. We never ask for race, sexual orientation, political or religious beliefs or health data, and you never need to publish them to use the platform.
6. Location
Location is used for exactly what it promises: ranking places and plans by proximity. The browser or phone asks for it with your permission, and you can withdraw that permission from your device settings without losing your account: the platform keeps working, it just stops knowing what is nearby.
The addresses you save for delivery carry coordinates so a shipment can be calculated and routed. They are deleted when you delete the address, and your location record is erased when you close your account.
7. Messages and content
Messages in a plan or club are stored on our servers so participants can read them: they are not end-to-end encrypted and should not be used for sensitive information.
We do not routinely read conversations and never use them for advertising. A person does review a specific message when someone reports it, or when the law requires it.
8. Measurement, advertising and consent
We use two Google tools: Analytics 4, with the IP address anonymised, to understand how the site is used; and AdSense, to show the ads that pay for the site.
We also count visits with Cloudflare Web Analytics, from the provider that already delivers the site. It uses no cookies, stores nothing in your browser and does not identify you: it only adds up, in aggregate, which pages are viewed and how long they take to load. That is why it runs whether or not you accept the notice.
In the store and on the pages of places we also count, ourselves, how many people see the product list and each product page, add something to the cart or open checkout, how many open each place, and which link they arrived from (for example, a social network), to know whether what we publish works. It uses no cookies, stores nothing in your browser, and we do not keep your IP address: together with your browser it is turned into a code that changes every day, and the key it is computed with is discarded when the day ends, so afterwards it cannot be tied to you or used to recognise you from one day to the next. We honour the Do Not Track and Global Privacy Control signals: if your browser sends them, we count nothing. These counts are deleted after 90 days. They run whether or not you accept the notice, because they do not identify you.
Analytics does not load until you accept: while you have not answered the privacy notice, or if you decline, its script is never downloaded and nothing is sent. AdSense does ship with the page from the start, because a site that carries no ad code cannot even be reviewed by Google; what your answer decides is whether it may personalise: without an explicit yes, ads are picked from the content of the page and never from you. You can change your mind at any time in your preferences.
We do not sell your data and we do not hand Google what we know about you as a user: not your email, your purchases, your plans or your clubs. Google picks the ads from the content of the page, and may also personalise them from what it already knew about you on its own; that is controlled from the ad settings of your own Google account, not from here.
9. Who we share it with
We do not sell or trade personal data. We share it only with those needed to run the service, and only what each one needs:
| Who | What for | What they receive |
|---|---|---|
| Payment gateway (Wompi) | Charging the order and confirming the transaction | Amount, order reference, email and the payment details you enter in their environment |
| Product brand or supplier, and fulfilment | Preparing and delivering what you buy | Recipient, phone, ID number, address and order items |
| Email service (Resend) | Sending verifications, notices and news | Your email address and the message content |
| Cloud hosting (Google Cloud) | Serving the platform and storing files and images | Everything the platform stores, encrypted in transit |
| Sign-in with Google; measurement and advertising, if you accepted them | Your Google account identifier; aggregated usage data | |
| Authorities | When a legal order requires it | Only what the order asks for, and always on the record |
10. International transfers
The servers hosting the platform and the providers above are outside Colombia, mainly in the United States. Using the service authorises that transfer, which we make with providers offering adequate security levels and under contracts binding them to process the data only to serve us.
11. How long we keep it
Each piece of data lasts as long as its purpose needs:
| Data | How long |
|---|---|
| Account and profile | While the account exists; erased when you leave |
| Browser session | Up to 14 days from your last sign-in |
| Verification and password links | Hours: they expire on their own |
| Posts and messages | Until you delete them or the account is closed |
| Orders, payments and invoicing | As long as accounting and tax duties require, even after you leave |
| Technical and security logs | As long as needed to investigate incidents |
| Anonymous count of the store and the places | 90 days, then deleted |
| Reports and moderation decisions | While they support the decision and any appeal |
12. How we protect it
Passwords are stored hashed and cannot be recovered, only reset. Traffic runs over HTTPS. Session identifiers travel in cookies the page's JavaScript cannot read, and the one that renews your session is only sent to the route that needs it.
On every operation the server checks that whoever asks owns the data, not merely that they are signed in. Your card details never pass through ParchesNow: the gateway receives them directly.
No system is infallible. If an incident affected your data we would tell you and report it to the authority as the law requires.
13. Your rights
As the owner of your data you can exercise these rights, free of charge and without explaining why:
- Know what data of yours we process and get a copy.
- Update and correct it when it is partial, inaccurate or out of date.
- Request its deletion, unless a legal or contractual duty requires us to keep it.
- Withdraw the authorisation you gave.
- Request proof of the authorisation you granted.
- File a complaint with the Superintendency of Industry and Commerce, after trying to resolve it with us.
14. How to exercise them, and deadlines
Write to the support address with your request and the email of your account, so we can verify it is you.
A query is answered within ten business days; if that is not possible we tell you why and answer within the next five business days. A complaint is handled within fifteen business days, extendable by eight more with notice. These are the deadlines set by Law 1581 of 2012.
15. What happens when you leave
You request closure from your account and confirm it with your password. It cannot be undone.
Closing erases the data that identifies you: the email is replaced with an unusable one, the password is removed, and your name, photo, bio, username, city, links, interests and location record disappear. Your profile stops being visible even to someone holding the link, and every session is closed.
It does not erase posts, plans or reviews other people are already reading: they stay without your name or face, as «deleted account». Nor orders and their payments, which accounting duties require us to keep. If you want a specific piece of content removed as well, ask before you leave, or write to us.
16. Minors
The platform is not aimed at children under 14 and we do not knowingly process their data. Between 14 and 17 you need permission from whoever holds parental authority.
If you believe a child under 14 created an account, write to us: we close it and delete the data.
18. Changes to this policy
The version in force always lives at this address, with its revision date. If a change affects how we use your data we announce it before applying it and, where the law requires, ask for fresh authorisation.
19. Contact us
To exercise your rights or ask anything about privacy, write to us at [email protected]
Last revised: October 2026